EUVD-2026-104085
GHSA-9cr7-6wq5-54c2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify store using vulnerable plugin
-
ExploitRequest protected WooCommerce download without payment
-
ImpactRetrieve paid downloadable file
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the target WordPress site to run ElementsReady Addons for Elementor (version 6.7.2 or earlier) alongside WooCommerce, with at least one paid/protected downloadable product configured for sale - the flaw specifically bypasses the WooCommerce payment/access gate on those downloadable files. No authentication, user interaction, or special attacker privileges are needed (PR:N/UI:N), so any such store is remotely reachable; the key LIMITING factor is that the site must actually sell downloadable WooCommerce products through this plugin, which narrows the exploitable population to e-commerce deployments rather than all installs. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N = 5.3, Medium) describes a fully remote, low-complexity attack requiring no privileges and no user interaction - meaning any internet-facing site running the affected plugin can be hit directly. However, the technical impact is deliberately narrow: only a low confidentiality impact, with no integrity or availability effect (CWE-862, Missing Authorization), so this is a business/financial-logic flaw (free retrieval of paid files, revenue loss, potential IP leakage) rather than a path to code execution or site takeover. A public exploit exists (WPScan), which raises the likelihood of opportunistic, scripted abuse against known stores, but the vulnerability is NOT in CISA KEV and no EPSS probability was supplied in the input, so there is no evidence of confirmed active exploitation or a quantified exploitation forecast - do not treat POC availability as active exploitation. Net: a genuine but bounded priority for e-commerce sites that actually sell downloadable WooCommerce products through this plugin, and low priority elsewhere. No SSVC decision data was provided in the input. |
| Exploit ScenarioDerived | An unauthenticated attacker locates a WooCommerce store using ElementsReady Addons for Elementor that sells paid downloadable products, then directly requests the protected download endpoint without completing payment or authenticating. Because access to the file is not properly restricted, the server returns the paid downloadable file, letting the attacker obtain commercial content for free. A public proof-of-concept for this bypass is available via WPScan. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 19, 2026
Paid WooCommerce downloadable files can be retrieved without purchase on WordPress sites running ElementsReady Addons for Elementor through 6.7.2, because the plugin fails to enforce authorization on protected product download requests. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N (5.3 Medium) indicates a remote, low-complexity, unauthenticated attack with no user interaction; the practical exposure is limited to stores that actually sell protected downloadable products through the plugin. Publicly available exploit code exists, and no CISA KEV status or EPSS score is provided in the supplied data.
RemediationAI
No vendor-released patch identified at time of analysis for ElementsReady Addons for Elementor in the provided intelligence. Until a fixed release is available, the most reliable mitigation is to deactivate the plugin; the trade-off is loss of its Elementor addon functionality. If the plugin must remain active, stop selling downloadable products through the affected path and move paid files outside the web root or behind an entitlement-checked download handler that validates WooCommerce purchase/order state before serving the file, recognizing that this can break existing download links and requires testing. Also restrict web-server access to WooCommerce downloadable product directories so unauthenticated direct requests are denied, and monitor logs for anomalous download attempts; review the WPScan reference at https://wpscan.com/vulnerability/08afea88-4268-40b3-b5fb-0ac2546c3100/, NVD at https://nvd.nist.gov/vuln/detail/CVE-2026-91047, and VulDB at https://vuldb.com/vuln/422266 for updated remediation guidance.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ElementsReady Addons for Elementor is a WordPress plugin that extends Elementor, and the affected path involves WooCommerce's protected product download handling. The root cause maps to CWE-862 Missing Authorization: the plugin does not verify that a requester is entitled to a paid downloadable product before serving the file, allowing an unauthenticated request to bypass WooCommerce's payment/access gate. CPE data identifies the product as cpe:2.3:a:unknown:elementsready_addons_for_elementor:*:*:*:*:*:*:*:* and EUVD lists affected versions as 0 through 6.7.2. Exploitation requires the site to run the affected plugin with WooCommerce and at least one paid/protected downloadable product configured, so the vulnerable population is e-commerce deployments rather than all WordPress installs; the WPScan reference is marked as an exploit source.
Know when Elementsready Addons For Elementor gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Remote unauthenticated access with no interaction (AV:N/AC:L/PR:N/UI:N); only unauthorized disclosure of a protected file (C:L), with no integrity or availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
3DescriptionCVE.org
The ElementsReady Addons for Elementor WordPress plugin through 6.7.2 does not properly restrict access to protected WooCommerce product downloads, allowing unauthenticated users to bypass the payment requirement and retrieve any product's paid downloadable file.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB